1 /****************************************************************************
2  *  Genesis Plus
3  *  Mega Drive cartridge hardware support
4  *
5  *  Copyright (C) 2007-2019  Eke-Eke (Genesis Plus GX)
6  *
7  *  Many cartridge protections were initially documented by Haze
8  *  (http://haze.mameworld.info/)
9  *
10  *  Realtec mapper was documented by TascoDeluxe
11  *
12  *  Redistribution and use of this code or any derivative works are permitted
13  *  provided that the following conditions are met:
14  *
15  *   - Redistributions may not be sold, nor may they be used in a commercial
16  *     product or activity.
17  *
18  *   - Redistributions that are modified from the original source must include the
19  *     complete source code, including the source code for all components used by a
20  *     binary built from the modified sources. However, as a special exception, the
21  *     source code distributed need not include anything that is normally distributed
22  *     (in either source or binary form) with the major components (compiler, kernel,
23  *     and so on) of the operating system on which the executable runs, unless that
24  *     component itself accompanies the executable.
25  *
26  *   - Redistributions must reproduce the above copyright notice, this list of
27  *     conditions and the following disclaimer in the documentation and/or other
28  *     materials provided with the distribution.
29  *
30  *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
31  *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
32  *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
33  *  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
34  *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
35  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
36  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
37  *  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
38  *  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
39  *  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
40  *  POSSIBILITY OF SUCH DAMAGE.
41  *
42  ****************************************************************************************/
43 
44 #include "shared.h"
45 #include "eeprom_i2c.h"
46 #include "eeprom_spi.h"
47 
48 /* Cart database entry */
49 typedef struct
50 {
51   uint16 chk_1;       /* header checksum */
52   uint16 chk_2;       /* real checksum */
53   uint8 bank_start;   /* first mapped bank in $400000-$7fffff region */
54   uint8 bank_end;     /* last mapped bank in $400000-$7fffff region */
55   cart_hw_t cart_hw;  /* hardware description */
56 } md_entry_t;
57 
58 /* Function prototypes */
59 static void mapper_sega_w(uint32 data);
60 static void mapper_512k_w(uint32 address, uint32 data);
61 static void mapper_ssf2_w(uint32 address, uint32 data);
62 static void mapper_sf001_w(uint32 address, uint32 data);
63 static void mapper_sf002_w(uint32 address, uint32 data);
64 static void mapper_sf004_w(uint32 address, uint32 data);
65 static uint32 mapper_sf004_r(uint32 address);
66 static void mapper_t5740_w(uint32 address, uint32 data);
67 static uint32 mapper_t5740_r(uint32 address);
68 static void mapper_flashkit_w(uint32 address, uint32 data);
69 static uint32 mapper_flashkit_r(uint32 address);
70 static uint32 mapper_smw_64_r(uint32 address);
71 static void mapper_smw_64_w(uint32 address, uint32 data);
72 static void mapper_realtec_w(uint32 address, uint32 data);
73 static void mapper_seganet_w(uint32 address, uint32 data);
74 static void mapper_32k_w(uint32 data);
75 static void mapper_64k_w(uint32 data);
76 static void mapper_64k_multi_w(uint32 address);
77 static uint32 mapper_radica_r(uint32 address);
78 static void default_time_w(uint32 address, uint32 data);
79 static void default_regs_w(uint32 address, uint32 data);
80 static uint32 default_regs_r(uint32 address);
81 static uint32 default_regs_r_16(uint32 address);
82 static uint32 custom_regs_r(uint32 address);
83 static void custom_regs_w(uint32 address, uint32 data);
84 static void custom_alt_regs_w(uint32 address, uint32 data);
85 static uint32 topshooter_r(uint32 address);
86 static void topshooter_w(uint32 address, uint32 data);
87 static uint32 tekken_regs_r(uint32 address);
88 static void tekken_regs_w(uint32 address, uint32 data);
89 
90 /* Games that need extra hardware emulation:
91   - copy protection device
92   - custom ROM banking device
93 */
94 static const md_entry_t rom_database[] =
95 {
96 /* Funny World & Balloon Boy */
97   {0x0000,0x06ab,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},1,0,NULL,NULL,NULL,mapper_realtec_w}},
98 /* Whac-a-Critter */
99   {0xffff,0xf863,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},1,0,NULL,NULL,NULL,mapper_realtec_w}},
100 /* Earth Defense */
101   {0xffff,0x44fb,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},1,0,NULL,NULL,NULL,mapper_realtec_w}},
102 /* Tom Clown */
103   {0x0000,0xc0cd,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},1,0,NULL,NULL,NULL,mapper_realtec_w}},
104 
105 
106 /* RADICA (Volume 1) (bad dump ?) */
107   {0x0000,0x2326,0x00,0x00,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},0,1,mapper_radica_r,NULL,NULL,NULL}},
108 /* RADICA (Volume 1) */
109   {0x24f4,0xfc84,0x00,0x00,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},0,0,mapper_radica_r,NULL,NULL,NULL}},
110 /* RADICA (Volume 2) */
111   {0x104f,0x32e9,0x00,0x00,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},0,0,mapper_radica_r,NULL,NULL,NULL}},
112 
113 
114 /* Tenchi wo Kurau III: Sangokushi Gaiden - Chinese Fighter */
115   {0x9490,0x8180,0x40,0x6f,{{0x00,0x00,0x00,0x00},{0xf0000c,0xf0000c,0xf0000c,0xf0000c},{0x400000,0x400004,0x400008,0x40000c},0,1,NULL,NULL,default_regs_r,custom_alt_regs_w}},
116 
117 
118 /* Top Fighter */
119   {0x4eb9,0x5d8b,0x60,0x7f,{{0x00,0x00,0x00,0x00},{0xf00007,0xf00007,0xf00007,0xffffff},{0x600001,0x600003,0x600005,0x000000},0,1,NULL,NULL,default_regs_r,custom_regs_w}},
120 /* Soul Edge VS Samurai Spirits  */
121   {0x00ff,0x5d34,0x60,0x7f,{{0x00,0x00,0x00,0x00},{0xf00007,0xf00007,0xf00007,0xffffff},{0x600001,0x600003,0x600005,0x000000},0,1,NULL,NULL,default_regs_r,custom_regs_w}},
122 /* Mulan */
123   {0x0404,0x1b40,0x60,0x7f,{{0x00,0x00,0x00,0x00},{0xf00007,0xf00007,0xf00007,0xffffff},{0x600001,0x600003,0x600005,0x000000},0,1,NULL,NULL,default_regs_r,custom_regs_w}},
124 /* Pocket Monsters II */
125   {0x47f9,0x17e5,0x60,0x7f,{{0x00,0x00,0x00,0x00},{0xf00007,0xf00007,0xf00007,0xffffff},{0x600001,0x600003,0x600005,0x000000},0,1,NULL,NULL,default_regs_r,custom_regs_w}},
126 /* Lion King 3 */
127   {0x0000,0x507c,0x60,0x7f,{{0x00,0x00,0x00,0x00},{0xf00007,0xf00007,0xf00007,0xffffff},{0x600001,0x600003,0x600005,0x000000},0,1,NULL,NULL,default_regs_r,custom_regs_w}},
128 /* Super King Kong 99 */
129   {0x0000,0x7d6e,0x60,0x7f,{{0x00,0x00,0x00,0x00},{0xf00007,0xf00007,0xf00007,0xffffff},{0x600001,0x600003,0x600005,0x000000},0,1,NULL,NULL,default_regs_r,custom_regs_w}},
130 /* Gunfight 3-in-1 */
131   {0x0000,0x6ff8,0x60,0x7f,{{0x00,0x00,0x00,0x00},{0xf00007,0xf00007,0xf00007,0xffffff},{0x600001,0x600003,0x600005,0x000000},0,1,NULL,NULL,default_regs_r,custom_regs_w}},
132 /* Pokemon Stadium */
133   {0x0000,0x843c,0x70,0x7f,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},0,1,NULL,NULL,NULL,custom_regs_w}},
134 
135 
136 /* Tekken 3 Special (original dump) (a bootleg version also exists, with patched protection & different boot routine which reads unused !TIME mapped area) */
137   {0x0000,0xc2f0,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},0,0,NULL,NULL,tekken_regs_r,tekken_regs_w}},
138 
139 
140 /* Lion King 2 */
141   {0xffff,0x1d9b,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xfffffd,0xfffffd,0xffffff,0xffffff},{0x400000,0x400004,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,default_regs_w}},
142 /* Squirell King */
143   {0x0000,0x8ec8,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xfffffd,0xfffffd,0xffffff,0xffffff},{0x400000,0x400004,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,default_regs_w}},
144 /* Tiny Toon Adventures 3 */
145   {0x2020,0xed9c,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xfffffd,0xfffffd,0xffffff,0xffffff},{0x400000,0x400004,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,default_regs_w}},
146 /* Lian Huan Pao - Barver Battle Saga (registers accessed by Z80, related to sound engine ?) */
147   {0x30b9,0x1c2a,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xfffffd,0xfffffd,0xffffff,0xffffff},{0x400000,0x400004,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,default_regs_w}},
148 /* Shui Hu Zhuan (registers accessed by Z80, related to sound engine ?) */
149   {0x6001,0x0211,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xfffffd,0xfffffd,0xffffff,0xffffff},{0x400000,0x400004,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,default_regs_w}},
150 /* Feng Shen Ying Jie Chuan (registers accessed by Z80, related to sound engine ?) */
151   {0xffff,0x5d98,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xfffffd,0xfffffd,0xffffff,0xffffff},{0x400000,0x400004,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,default_regs_w}},
152 /* (*) Shui Hu - Feng Yun Zhuan (patched ROM, unused registers) */
153   {0x3332,0x872b,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xfffffd,0xfffffd,0xffffff,0xffffff},{0x400000,0x400004,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,default_regs_w}},
154 
155 
156 /* (*) Chao Ji Da Fu Weng (patched ROM, various words witten to register, long word also read from $7E0000, unknown banking hardware ?) */
157   {0xa697,0xa697,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x000000,0x000000,0x000000},0,0,NULL,NULL,NULL,default_regs_w}},
158 
159 /* (*) Aq Renkan Awa (patched ROM, ON/OFF bit sequence is written to register, unknown banking hardware ?) */
160   {0x8104,0x0517,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400001,0x000000,0x000000,0x000000},0,0,NULL,NULL,NULL,default_regs_w}},
161 
162 
163 /* (*) Tun Shi Tian Di III (patched ROM, unused register) */
164   {0x0000,0x9c5e,0x40,0x40,{{0xab,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400046,0x000000,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,NULL}},
165 
166 
167 /* Ma Jiang Qing Ren - Ji Ma Jiang Zhi */
168   {0x0000,0x7037,0x40,0x40,{{0x90,0xd3,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x401000,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,NULL}},
169 /* Super Majon Club */
170   {0x0000,0x3b95,0x40,0x40,{{0x90,0xd3,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x401000,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,NULL}},
171 /* Feng Kuang Tao Hua Yuan (original version from Creaton Softec Inc) (a bootleg version also exists with patched protection and minor title screen variations) */
172   {0x0000,0x9dc4,0x40,0x40,{{0x90,0xd3,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x401000,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,NULL}},
173 
174 
175 /* (*) Jiu Ji Ma Jiang II - Ye Yan Bian (patched ROM, using expected register value - $0f - crashes the game) (uses 16-bits reads) */
176   {0x0c44,0xba81,0x40,0x40,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x400006},0,0,NULL,NULL,default_regs_r_16,NULL}},
177 /* 16 Zhang Ma Jiang (uses 16-bits reads) */
178   {0xfb40,0x4bed,0x40,0x40,{{0x00,0xaa,0x00,0xf0},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x400002,0x000000,0x400006},0,0,NULL,NULL,default_regs_r_16,NULL}},
179 /* 16 Tiles Mahjong II (uses 16-bits reads) */
180   {0xffff,0x0903,0x40,0x40,{{0x00,0x00,0xc9,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x400004,0x000000},0,0,NULL,NULL,default_regs_r_16,NULL}},
181 /* Thunderbolt II (uses 16-bits reads) */
182   {0x0000,0x1585,0x40,0x40,{{0x55,0x0f,0xaa,0xf0},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r_16,NULL}},
183 
184 
185 /* Chaoji Puke - Super Poker (correct ROM dump, original release is an overdump) */
186   {0xffff,0xd7b0,0x40,0x40,{{0x55,0x0f,0xaa,0xf0},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r,NULL}},
187 /* Super Bubble Bobble */
188   {0x0000,0x16cd,0x40,0x40,{{0x55,0x0f,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x000000,0x000000},0,0,NULL,NULL,default_regs_r,NULL}},
189 /* Tenchi wo Kurau II - The Battle of Red Cliffs (Unl) */
190   {0x0000,0xed61,0x40,0x40,{{0x55,0x0f,0xaa,0xf0},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r,NULL}},
191 /* Huan Le Tao Qi Shu - Smart Mouse */
192   {0x0000,0x1a28,0x40,0x40,{{0x55,0x0f,0xaa,0xf0},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r,NULL}},
193 /* (*) Hei Tao 2 - Super Big 2 (patched ROM, unused registers) */
194   {0x0000,0x5843,0x40,0x40,{{0x55,0x0f,0xaa,0xf0},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r,NULL}},
195 /* Mighty Morphin Power Rangers - The Fighting Edition */
196   {0x0000,0x2288,0x40,0x40,{{0x55,0x0f,0xc9,0x18},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r,NULL}},
197 /* Elf Wor */
198   {0x0080,0x3dba,0x40,0x40,{{0x55,0x0f,0xc9,0x18},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r,NULL}},
199 /* Ya-Se Chuanshuo */
200   {0xffff,0xd472,0x40,0x40,{{0x63,0x98,0xc9,0x18},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r,NULL}},
201 /* 777 Casino (For first one, 0x55 works as well. Other values are never used so they are guessed from on other unlicensed games using similar mapper) */
202   {0x0000,0xf8d9,0x40,0x40,{{0x63,0x98,0xc9,0x18},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r,NULL}},
203 /* Wu Kong Wai Zhuan (original) (a bootleg version also exists, with patched protection & modified SRAM test routine ?) */
204   {0x0000,0x19ff,0x40,0x40,{{0x63,0x98,0xc9,0x18},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r,NULL}},
205 /* Soul Blade */
206   {0x0000,0x0c5b,0x40,0x40,{{0x63,0x98,0xc9,0xf0},{0xffffff,0xffffff,0xffffff,0xffffff},{0x400000,0x400002,0x400004,0x400006},0,0,NULL,NULL,default_regs_r,NULL}},
207 
208 
209 /* King of Fighter 98 */
210   {0x0000,0xd0a0,0x48,0x4f,{{0x00,0x00,0xaa,0xf0},{0xffffff,0xffffff,0xfc0000,0xfc0000},{0x000000,0x000000,0x480000,0x4c0000},0,0,NULL,NULL,default_regs_r,NULL}},
211 
212 
213 /* Rockman X3 (bootleg version ? two last register returned values are ignored, note that 0xaa/0x18 would work as well) */
214   {0x0000,0x9d0e,0x40,0x40,{{0x0c,0x00,0xc9,0xf0},{0xffffff,0xffffff,0xffffff,0xffffff},{0xa13000,0x000000,0x400004,0x400006},0,0,default_regs_r,NULL,default_regs_r,NULL}},
215 
216 
217 /* (*) Dragon Ball Final Bout  (patched ROM, in original code, different switches occurs depending on returned value $00-$0f) */
218   {0xc65a,0xc65a,0x00,0x00,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0xa13000,0x000000,0x000000,0x000000},0,0,default_regs_r,NULL,NULL,NULL}},
219 /* (*) Yang Jia Jiang - Yang Warrior Family (patched ROM, register value unused) */
220   {0x0000,0x96b0,0x00,0x00,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0xa13000,0x000000,0x000000,0x000000},0,0,default_regs_r,NULL,NULL,NULL}},
221 /* Super Mario 2 1998 */
222   {0xffff,0x0474,0x00,0x00,{{0x0a,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0xa13000,0x000000,0x000000,0x000000},0,0,default_regs_r,NULL,NULL,NULL}},
223 /* Super Mario World */
224   {0x2020,0xb4eb,0x00,0x00,{{0x1c,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0xa13000,0x000000,0x000000,0x000000},0,0,default_regs_r,NULL,NULL,NULL}},
225 
226 
227 /* King of Fighter 99 */
228   {0x0000,0x021e,0x00,0x00,{{0x00,0x01,0x1f,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0xa13000,0xa13002,0xa1303e,0x000000},0,0,custom_regs_r,default_regs_w,NULL,NULL}},
229 /* Pocket Monster */
230   {0xd6fc,0x1eb1,0x00,0x00,{{0x00,0x01,0x1f,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0xa13000,0xa13002,0xa1303e,0x000000},0,0,custom_regs_r,default_regs_w,NULL,NULL}},
231 /* Pocket Monster (bootleg version ? two last register returned values are ignored & first register test has been modified) */
232   {0xd6fc,0x6319,0x00,0x00,{{0x14,0x01,0x1f,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0xa13000,0xa13002,0xa1303e,0x000000},0,0,default_regs_r,m68k_unused_8_w,NULL,NULL}},
233 /* A Bug's Life (bootleg version ? two last register returned values are ignored & first register test has been modified ?) */
234   {0x7f7f,0x2aad,0x00,0x00,{{0x28,0x01,0x1f,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0xa13000,0xa13002,0xa1303e,0x000000},0,0,default_regs_r,m68k_unused_8_w,NULL,NULL}},
235 
236 
237 /* Game no Kanzume Otokuyou */
238   {0x0000,0xf9d1,0x00,0x00,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},0,0,NULL,mapper_seganet_w,NULL,NULL}},
239 
240 
241 /* Top Shooter (arcade hardware) */
242   {0xffff,0x3632,0x20,0x20,{{0x00,0x00,0x00,0x00},{0xffffff,0xffffff,0xffffff,0xffffff},{0x000000,0x000000,0x000000,0x000000},0,0,NULL,NULL,topshooter_r,topshooter_w}}
243 };
244 
245 
246 /************************************************************
247           Cart Hardware initialization
248 *************************************************************/
249 
md_cart_init(void)250 void md_cart_init(void)
251 {
252   int i;
253 
254   /***************************************************************************************************************
255                 CARTRIDGE ROM MIRRORING
256    ***************************************************************************************************************
257 
258     MD Cartridge area is mapped to $000000-$3fffff:
259 
260       -> when accessing ROM, 68k address lines A1 to A21 can be used by the internal cartridge hardware to decode
261          full 4MB address range.
262       -> depending on ROM total size and additional decoding hardware, some address lines might be ignored,
263          resulting in ROM mirroring.
264 
265     Cartridges can use either 8-bits (x2) or 16-bits (x1, x2) Mask ROM chips, each chip size is a factor of 2 bytes:
266 
267       -> two 8-bits chips are equivalent to one 16-bits chip, no specific address decoding is required, needed
268          address lines are simply connected to each chip, upper address lines are ignored and data lines are
269          connected appropriately to each chip (D0-D7 to one chip, D8-D15 to the other one).
270          ROM is generally mirrored each N bytes where N=2^(k+1) is the total ROM size (ROM1+ROM2,ROM1+ROM2,...)
271 
272       -> one single 16-bits chip do not need specific address decoding, address lines are simply connected
273          depending on the ROM size, upper address lines being ignored.
274          ROM is generally mirrored each N bytes where N=2^k is the size of the ROM chip (ROM1,ROM1,ROM1,...)
275 
276       -> two 16-bits chips of the same size are equivalent to one chip of double size, address decoding generally
277          is the same except that specific hardware is used (one address line is generally used for chip selection,
278          lower ones being used to address the chips and upper ones being ignored).
279          ROM is generally mirrored each N bytes where N=2^(k+1) is the total ROM size (ROM1,ROM2,ROM1,ROM2,...)
280 
281       -> two 16-bits chips with different size are mapped differently. Address decoding is done the same way as
282          above (one address line used for chip selection) but the ignored & required address lines differ from
283          one chip to another, which makes ROM mirroring different.
284          ROM2 size is generally half of ROM1 size and upper half ignored (ROM1,ROM2,XXXX,ROM1,ROM2,XXXX,...)
285 
286       From the emulator point of view, we only need to distinguish 2 cases:
287 
288       1/ total ROM size is a factor of 2: ROM is mirrored each 2^k bytes.
289 
290       2/ total ROM size is not a factor of 2: ROM is padded up to 2^k then mirrored each 2^k bytes.
291 
292   ******************************************************************************************************************/
293 
294   /* calculate nearest size with factor of 2 */
295   unsigned int size = 0x10000;
296   while (cart.romsize > size)
297     size <<= 1;
298 
299   /* Sonic & Knuckles */
300   if (strstr(rominfo.international,"SONIC & KNUCKLES"))
301   {
302     /* disable ROM mirroring at $200000-$3fffff (normally mapped to external cartridge) */
303     size = 0x400000;
304   }
305 
306   /* total ROM size is not a factor of 2  */
307   /* TODO: handle all possible ROM configurations using cartridge database */
308   if (cart.romsize < size)
309   {
310     if (size < MAXROMSIZE)
311     {
312       /* ROM is padded up to 2^k bytes */
313       memset(cart.rom + cart.romsize, 0xff, size - cart.romsize);
314     }
315     else
316     {
317       /* ROM is padded up to max ROM size */
318       memset(cart.rom + cart.romsize, 0xff, MAXROMSIZE - cart.romsize);
319     }
320   }
321 
322   /* ROM is mirrored each 2^k bytes */
323   cart.mask = size - 1;
324 
325   /* no special external hardware required by default */
326   cart.special = 0;
327 
328   /**********************************************
329           DEFAULT CARTRIDGE MAPPING
330   ***********************************************/
331   for (i=0; i<0x40; i++)
332   {
333     /* cartridge ROM */
334     m68k.memory_map[i].base     = cart.rom + ((i<<16) & cart.mask);
335     m68k.memory_map[i].read8    = NULL;
336     m68k.memory_map[i].read16   = NULL;
337     m68k.memory_map[i].write8   = m68k_unused_8_w;
338     m68k.memory_map[i].write16  = m68k_unused_16_w;
339     zbank_memory_map[i].read    = NULL;
340     zbank_memory_map[i].write   = zbank_unused_w;
341   }
342 
343   for (i=0x40; i<0x80; i++)
344   {
345     /* unused area */
346     m68k.memory_map[i].base     = cart.rom + (i<<16);
347     m68k.memory_map[i].read8    = m68k_read_bus_8;
348     m68k.memory_map[i].read16   = m68k_read_bus_16;
349     m68k.memory_map[i].write8   = m68k_unused_8_w;
350     m68k.memory_map[i].write16  = m68k_unused_16_w;
351     zbank_memory_map[i].read    = zbank_unused_r;
352     zbank_memory_map[i].write   = zbank_unused_w;
353   }
354 
355   /* support for Quackshot REV 01 (real) dump */
356   if (strstr(rominfo.product,"00004054-01") && (cart.romsize == 0x80000))
357   {
358     /* $000000-$0fffff: first 256K mirrored (A18 not connected to ROM chip, A19 not decoded) */
359     for (i=0x00; i<0x10; i++)
360     {
361       /* $200000-$3fffff: mirror of $000000-$1fffff (A21 not decoded) */
362       m68k.memory_map[i].base = m68k.memory_map[i + 0x20].base = cart.rom + ((i & 0x03) << 16);
363     }
364 
365     /* $100000-$1fffff: second 256K mirrored (A20 connected to ROM chip A18) */
366     for (i=0x10; i<0x20; i++)
367     {
368       /* $200000-$3fffff: mirror of $000000-$1fffff (A21 not decoded) */
369       m68k.memory_map[i].base = m68k.memory_map[i + 0x20].base = cart.rom + 0x40000 + ((i & 0x03) << 16);
370     }
371   }
372 
373   /**********************************************
374           BACKUP MEMORY
375   ***********************************************/
376   sram_init();
377   eeprom_i2c_init();
378 
379   /* memory-mapped SRAM */
380   if (sram.on && !sram.custom)
381   {
382     /* SRAM is mapped by default unless it overlaps with ROM area (Phantasy Star 4, Beyond Oasis/Legend of Thor, World Series Baseball 9x, Duke Nukem 3D,...) */
383     if (sram.start >= size)
384     {
385       m68k.memory_map[sram.start >> 16].base    = sram.sram;
386       m68k.memory_map[sram.start >> 16].read8   = sram_read_byte;
387       m68k.memory_map[sram.start >> 16].read16  = sram_read_word;
388       m68k.memory_map[sram.start >> 16].write8  = sram_write_byte;
389       m68k.memory_map[sram.start >> 16].write16 = sram_write_word;
390       zbank_memory_map[sram.start >> 16].read   = sram_read_byte;
391       zbank_memory_map[sram.start >> 16].write  = sram_write_byte;
392     }
393 
394     /* support for Triple Play 96 & Triple Play - Gold Edition (available ROM dumps include dumped SRAM data) */
395     else if ((strstr(rominfo.product,"T-172026") != NULL) || (strstr(rominfo.product,"T-172116") != NULL))
396     {
397       /* $000000-$1fffff and $300000-$3fffff: cartridge ROM (2MB + 1MB) */
398       /* $200000-$2fffff: SRAM (32 KB mirrored) */
399       for (i=0x20; i<0x30; i++)
400       {
401         m68k.memory_map[i].base    = sram.sram;
402         m68k.memory_map[i].read8   = sram_read_byte;
403         m68k.memory_map[i].read16  = sram_read_word;
404         m68k.memory_map[i].write8  = sram_write_byte;
405         m68k.memory_map[i].write16 = sram_write_word;
406         zbank_memory_map[i].read   = sram_read_byte;
407         zbank_memory_map[i].write  = sram_write_byte;
408       }
409     }
410   }
411 
412   /**********************************************
413           SVP CHIP
414   ***********************************************/
415   svp = NULL;
416   if (strstr(rominfo.international,"Virtua Racing"))
417   {
418     svp_init();
419   }
420 
421   /**********************************************
422           LOCK-ON
423   ***********************************************/
424 
425   /* clear existing patches */
426   ggenie_shutdown();
427   areplay_shutdown();
428 
429   /* initialize extra hardware */
430   switch (config.lock_on)
431   {
432     case TYPE_GG:
433     {
434       ggenie_init();
435       break;
436     }
437 
438     case TYPE_AR:
439     {
440       areplay_init();
441       break;
442     }
443 
444     case TYPE_SK:
445     {
446       /* store S&K ROM above cartridge ROM (and before backup memory) */
447       if (cart.romsize > 0x600000) break;
448 
449       /* try to load Sonic & Knuckles ROM file (2 MB) */
450       if (load_archive(SK_ROM, cart.rom + 0x600000, 0x200000, NULL) == 0x200000)
451       {
452         /* check ROM header */
453         if (!memcmp(cart.rom + 0x600000 + 0x120, "SONIC & KNUCKLES",16))
454         {
455           /* try to load Sonic 2 & Knuckles UPMEM ROM (256 KB) */
456           if (load_archive(SK_UPMEM, cart.rom + 0x900000, 0x40000, NULL) == 0x40000)
457           {
458             /* $000000-$1FFFFF is mapped to S&K ROM */
459             for (i=0x00; i<0x20; i++)
460             {
461               m68k.memory_map[i].base = cart.rom + 0x600000 + (i << 16);
462             }
463 
464 #ifdef LSB_FIRST
465             for (i=0; i<0x200000; i+=2)
466             {
467               /* Byteswap ROM */
468               uint8 temp = cart.rom[i + 0x600000];
469               cart.rom[i + 0x600000] = cart.rom[i + 0x600000 + 1];
470               cart.rom[i + 0x600000 + 1] = temp;
471             }
472 
473             for (i=0; i<0x40000; i+=2)
474             {
475               /* Byteswap ROM */
476               uint8 temp = cart.rom[i + 0x900000];
477               cart.rom[i + 0x900000] = cart.rom[i + 0x900000 + 1];
478               cart.rom[i + 0x900000 + 1] = temp;
479             }
480 #endif
481             cart.special |= HW_LOCK_ON;
482           }
483         }
484       }
485       break;
486     }
487 
488     default:
489     {
490       break;
491     }
492   }
493 
494   /**********************************************
495         CARTRIDGE EXTRA HARDWARE
496   ***********************************************/
497   memset(&cart.hw, 0, sizeof(cart.hw));
498 
499   /* search for game into database */
500   for (i=0; i<(sizeof(rom_database)/sizeof(md_entry_t)); i++)
501   {
502     /* known cart found ! */
503     if ((rominfo.checksum == rom_database[i].chk_1) &&
504         (rominfo.realchecksum == rom_database[i].chk_2))
505     {
506       int j = rom_database[i].bank_start;
507 
508       /* retrieve hardware information */
509       memcpy(&cart.hw, &(rom_database[i].cart_hw), sizeof(cart.hw));
510 
511       /* initialize memory handlers for $400000-$7FFFFF region */
512       while (j <= rom_database[i].bank_end)
513       {
514         if (cart.hw.regs_r)
515         {
516           m68k.memory_map[j].read8    = cart.hw.regs_r;
517           m68k.memory_map[j].read16   = cart.hw.regs_r;
518           zbank_memory_map[j].read    = cart.hw.regs_r;
519         }
520         if (cart.hw.regs_w)
521         {
522           m68k.memory_map[j].write8   = cart.hw.regs_w;
523           m68k.memory_map[j].write16  = cart.hw.regs_w;
524           zbank_memory_map[j].write   = cart.hw.regs_w;
525         }
526         j++;
527       }
528 
529       /* leave loop */
530       break;
531     }
532   }
533 
534   /* Realtec mapper */
535   if (cart.hw.realtec)
536   {
537     /* 8k BOOT ROM */
538     for (i=0; i<8; i++)
539     {
540       memcpy(cart.rom + 0x900000 + i*0x2000, cart.rom + 0x7e000, 0x2000);
541     }
542 
543     /* BOOT ROM is mapped to $000000-$3FFFFF */
544     for (i=0x00; i<0x40; i++)
545     {
546       m68k.memory_map[i].base = cart.rom + 0x900000;
547     }
548   }
549 
550   /* detect specific mappers */
551   if (strstr(rominfo.consoletype,"SEGA SSF"))
552   {
553     /* Everdrive extended SSF mapper */
554     cart.hw.time_w = mapper_512k_w;
555 
556     /* cartridge ROM mapping is reinitialized on /VRES */
557     cart.hw.bankshift = 1;
558   }
559   else if (strstr(rominfo.domestic,"SUPER STREET FIGHTER2"))
560   {
561     /* SSF2 mapper */
562     cart.hw.time_w = mapper_ssf2_w;
563 
564     /* cartridge ROM mapping is reinitialized on /VRES */
565     cart.hw.bankshift = 1;
566   }
567   else if (strstr(rominfo.product,"T-5740"))
568   {
569     /* T-5740XX-XX mapper */
570     cart.hw.bankshift = 1;
571     m68k.memory_map[0x01].read8 = mapper_t5740_r;
572     zbank_memory_map[0x01].read = mapper_t5740_r;
573 
574     /* specific !TIME handlers */
575     cart.hw.time_w = mapper_t5740_w;
576     cart.hw.time_r = eeprom_spi_read;
577 
578     /* initialize SPI EEPROM board */
579     eeprom_spi_init();
580   }
581   else if (strstr(rominfo.ROMType,"SF") && strstr(rominfo.product,"001"))
582   {
583     /* SF-001 mapper */
584     m68k.memory_map[0x00].write8 = mapper_sf001_w;
585     m68k.memory_map[0x00].write16 = mapper_sf001_w;
586     zbank_memory_map[0x00].write = mapper_sf001_w;
587 
588     /* no !TIME handler */
589     cart.hw.time_w = m68k_unused_8_w;
590 
591     /* cartridge ROM is mapped to $3C0000-$3FFFFF on reset */
592     for (i=0x3c; i<0x40; i++)
593     {
594       m68k.memory_map[i].base     = cart.rom + (i << 16);
595       m68k.memory_map[i].read8    = NULL;
596       m68k.memory_map[i].read16   = NULL;
597       m68k.memory_map[i].write8   = m68k_unused_8_w;
598       m68k.memory_map[i].write16  = m68k_unused_16_w;
599       zbank_memory_map[i].read    = NULL;
600       zbank_memory_map[i].write   = m68k_unused_8_w;
601     }
602   }
603   else if (strstr(rominfo.ROMType,"SF") && strstr(rominfo.product,"002"))
604   {
605     /* SF-002 mapper */
606     m68k.memory_map[0x00].write8 = mapper_sf002_w;
607     m68k.memory_map[0x00].write16 = mapper_sf002_w;
608     zbank_memory_map[0x00].write = mapper_sf002_w;
609 
610     /* no !TIME handler */
611     cart.hw.time_w = m68k_unused_8_w;
612   }
613   else if (strstr(rominfo.ROMType,"SF") && strstr(rominfo.product,"004"))
614   {
615     /* SF-004 mapper */
616     m68k.memory_map[0x00].write8 = mapper_sf004_w;
617     m68k.memory_map[0x00].write16 = mapper_sf004_w;
618     zbank_memory_map[0x00].write = mapper_sf004_w;
619 
620     /* specific !TIME handlers */
621     cart.hw.time_r = mapper_sf004_r;
622     cart.hw.time_w = m68k_unused_8_w;
623 
624     /* first 256K ROM bank is mirrored into $000000-$1FFFFF on reset */
625     for (i=0x00; i<0x20; i++)
626     {
627       m68k.memory_map[i].base = cart.rom + ((i & 0x03) << 16);
628     }
629 
630     /* 32K static RAM mapped to $200000-$2FFFFF is disabled on reset */
631     for (i=0x20; i<0x30; i++)
632     {
633       m68k.memory_map[i].base    = sram.sram;
634       m68k.memory_map[i].read8   = m68k_read_bus_8;
635       m68k.memory_map[i].read16  = m68k_read_bus_16;
636       m68k.memory_map[i].write8  = m68k_unused_8_w;
637       m68k.memory_map[i].write16 = m68k_unused_16_w;
638       zbank_memory_map[i].read   = m68k_read_bus_8;
639       zbank_memory_map[i].write  = zbank_unused_w;
640     }
641 
642     /* $300000-$3FFFFF is not mapped */
643     for (i=0x30; i<0x40; i++)
644     {
645       m68k.memory_map[i].read8   = m68k_read_bus_8;
646       m68k.memory_map[i].read16  = m68k_read_bus_16;
647       m68k.memory_map[i].write8  = m68k_unused_8_w;
648       m68k.memory_map[i].write16 = m68k_unused_16_w;
649       zbank_memory_map[i].read   = m68k_read_bus_8;
650       zbank_memory_map[i].write  = zbank_unused_w;
651     }
652   }
653   else if (strstr(rominfo.ROMType,"GM") && strstr(rominfo.product,"00000000-42"))
654   {
655     /* Flashkit MD mapper */
656     m68k.memory_map[0x00].write8 = mapper_flashkit_w;
657     m68k.memory_map[0x00].write16 = mapper_flashkit_w;
658     zbank_memory_map[0x00].write = mapper_flashkit_w;
659   }
660   else if ((*(uint16 *)(cart.rom + 0x08) == 0x6000) && (*(uint16 *)(cart.rom + 0x0a) == 0x01f6) && (rominfo.realchecksum == 0xf894))
661   {
662     /* Super Mario World 64 (unlicensed) mapper */
663     for (i=0x08; i<0x10; i++)
664     {
665       /* lower 512KB mirrored */
666       m68k.memory_map[i].base = cart.rom + ((i & 7) << 16);
667     }
668 
669     for (i=0x10; i<0x40; i++)
670     {
671       /* unused area */
672       m68k.memory_map[i].read8   = m68k_read_bus_8;
673       m68k.memory_map[i].read16  = m68k_read_bus_16;
674       m68k.memory_map[i].write8  = m68k_unused_8_w;
675       m68k.memory_map[i].write16 = m68k_unused_16_w;
676       zbank_memory_map[i].read   = m68k_read_bus_8;
677       zbank_memory_map[i].write  = zbank_unused_w;
678     }
679 
680     for (i=0x60; i<0x70; i++)
681     {
682       /* custom hardware */
683       m68k.memory_map[i].base   = cart.rom + 0x0f0000;
684       m68k.memory_map[i].read8  = ((i & 0x07) < 0x04) ? NULL : mapper_smw_64_r;
685       m68k.memory_map[i].read16  = ((i & 0x07) < 0x04) ? NULL : mapper_smw_64_r;
686       m68k.memory_map[i].write8 = mapper_smw_64_w;
687       m68k.memory_map[i].write16 = mapper_smw_64_w;
688       zbank_memory_map[i].read  = ((i & 0x07) < 0x04) ? NULL : mapper_smw_64_r;
689       zbank_memory_map[i].write = mapper_smw_64_w;
690     }
691   }
692   else if (cart.romsize > 0x400000)
693   {
694     /* assume linear ROM mapping by default (max. 10MB) */
695     for (i=0x40; i<0xA0; i++)
696     {
697       m68k.memory_map[i].base   = cart.rom + (i<<16);
698       m68k.memory_map[i].read8  = NULL;
699       m68k.memory_map[i].read16 = NULL;
700       zbank_memory_map[i].read  = NULL;
701     }
702   }
703 
704   /* default write handler for !TIME range ($A130xx)*/
705   if (!cart.hw.time_w)
706   {
707     cart.hw.time_w = default_time_w;
708   }
709 }
710 
711 /* hardware that need to be reseted on power on */
md_cart_reset(int hard_reset)712 void md_cart_reset(int hard_reset)
713 {
714   int i;
715 
716   /* reset cartridge mapping */
717   if (cart.hw.bankshift)
718   {
719     for (i=0x00; i<0x40; i++)
720     {
721       m68k.memory_map[i].base = cart.rom + ((i<<16) & cart.mask);
722     }
723   }
724 
725   /* SVP chip */
726   if (svp)
727   {
728     svp_reset();
729   }
730 
731   /* Lock-ON */
732   switch (config.lock_on)
733   {
734     case TYPE_GG:
735     {
736       ggenie_reset(hard_reset);
737       break;
738     }
739 
740     case TYPE_AR:
741     {
742       areplay_reset(hard_reset);
743       break;
744     }
745 
746     case TYPE_SK:
747     {
748       if (cart.special & HW_LOCK_ON)
749       {
750         /* disable UPMEM chip at $300000-$3fffff */
751         for (i=0x30; i<0x40; i++)
752         {
753           m68k.memory_map[i].base = cart.rom + ((i<<16) & cart.mask);
754         }
755       }
756       break;
757     }
758 
759     default:
760     {
761       break;
762     }
763   }
764 }
765 
md_cart_context_save(uint8 * state)766 int md_cart_context_save(uint8 *state)
767 {
768   int i;
769   int bufferptr = 0;
770   uint8 *base;
771 
772   /* cartridge mapping */
773   for (i=0; i<0x40; i++)
774   {
775     /* get base address */
776     base = m68k.memory_map[i].base;
777 
778     if (base == sram.sram)
779     {
780       /* SRAM */
781       state[bufferptr++] = 0xff;
782     }
783     else if (base >= cart.rom && base < cart.rom + MAXROMSIZE)
784     {
785       /* ROM */
786       state[bufferptr++] = ((base - cart.rom) >> 16) & 0xff;
787     }
788     else
789     {
790       /* TMSS or special cartridge rom */
791       state[bufferptr++] = 0xfe;
792     }
793   }
794 
795   /* hardware registers */
796   save_param(cart.hw.regs, sizeof(cart.hw.regs));
797 
798   /* SVP */
799   if (svp)
800   {
801     save_param(svp->iram_rom, 0x800);
802     save_param(svp->dram,sizeof(svp->dram));
803     save_param(&svp->ssp1601,sizeof(ssp1601_t));
804   }
805 
806   return bufferptr;
807 }
808 
md_cart_context_load(uint8 * state)809 int md_cart_context_load(uint8 *state)
810 {
811   int i;
812   int bufferptr = 0;
813   uint8 offset;
814 
815   /* cartridge mapping */
816   for (i=0; i<0x40; i++)
817   {
818     /* get offset */
819     offset = state[bufferptr++];
820 
821     if (offset == 0xff)
822     {
823       /* SRAM */
824       m68k.memory_map[i].base     = sram.sram;
825       m68k.memory_map[i].read8    = sram_read_byte;
826       m68k.memory_map[i].read16   = sram_read_word;
827       m68k.memory_map[i].write8   = sram_write_byte;
828       m68k.memory_map[i].write16  = sram_write_word;
829       zbank_memory_map[i].read    = sram_read_byte;
830       zbank_memory_map[i].write   = sram_write_byte;
831 
832     }
833     else if (offset < (MAXROMSIZE >> 16))
834     {
835       /* check if SRAM was mapped there before loading state */
836       if (m68k.memory_map[i].base == sram.sram)
837       {
838         m68k.memory_map[i].read8    = NULL;
839         m68k.memory_map[i].read16   = NULL;
840         m68k.memory_map[i].write8   = m68k_unused_8_w;
841         m68k.memory_map[i].write16  = m68k_unused_16_w;
842         zbank_memory_map[i].read    = NULL;
843         zbank_memory_map[i].write   = zbank_unused_w;
844       }
845 
846       /* ROM */
847       m68k.memory_map[i].base = cart.rom + (offset << 16);
848     }
849     else
850     {
851       /* TMSS or Special cartridge ROM mapped in by reset, leave it mapped */
852     }
853   }
854 
855   /* hardware registers */
856   load_param(cart.hw.regs, sizeof(cart.hw.regs));
857 
858   /* SVP */
859   if (svp)
860   {
861     load_param(svp->iram_rom, 0x800);
862     load_param(svp->dram,sizeof(svp->dram));
863     load_param(&svp->ssp1601,sizeof(ssp1601_t));
864   }
865 
866   return bufferptr;
867 }
868 
869 /************************************************************
870           MAPPER handlers
871 *************************************************************/
872 
873 /*
874   "official" ROM/SRAM bankswitch (Phantasy Star IV, Story of Thor/Beyond Oasis, Sonic 3 & Knuckles)
875 */
mapper_sega_w(uint32 data)876 static void mapper_sega_w(uint32 data)
877 {
878   int i;
879 
880   if (data & 1)
881   {
882     if (sram.on)
883     {
884       /* Backup RAM mapped to $200000-$20ffff (normally mirrored up to $3fffff but this breaks Sonic Megamix and no game need it) */
885       m68k.memory_map[0x20].base    = sram.sram;
886       m68k.memory_map[0x20].read8   = sram_read_byte;
887       m68k.memory_map[0x20].read16  = sram_read_word;
888       zbank_memory_map[0x20].read   = sram_read_byte;
889 
890       /* Backup RAM write protection */
891       if (data & 2)
892       {
893         m68k.memory_map[0x20].write8  = m68k_unused_8_w;
894         m68k.memory_map[0x20].write16 = m68k_unused_16_w;
895         zbank_memory_map[0x20].write  = zbank_unused_w;
896       }
897       else
898       {
899         m68k.memory_map[0x20].write8  = sram_write_byte;
900         m68k.memory_map[0x20].write16 = sram_write_word;
901         zbank_memory_map[0x20].write  = sram_write_byte;
902       }
903     }
904 
905     /* S&K lock-on chip */
906     if ((cart.special & HW_LOCK_ON) && (config.lock_on == TYPE_SK))
907     {
908       /* S2K upmem chip mapped to $300000-$3fffff (256K mirrored) */
909       for (i=0x30; i<0x40; i++)
910       {
911         m68k.memory_map[i].base = (cart.rom + 0x900000) + ((i & 3) << 16);
912       }
913     }
914   }
915   else
916   {
917     /* cartridge ROM mapped to $200000-$3fffff */
918     for (i=0x20; i<0x40; i++)
919     {
920       m68k.memory_map[i].base     = cart.rom + ((i<<16) & cart.mask);
921       m68k.memory_map[i].read8    = NULL;
922       m68k.memory_map[i].read16   = NULL;
923       zbank_memory_map[i].read    = NULL;
924       m68k.memory_map[i].write8   = m68k_unused_8_w;
925       m68k.memory_map[i].write16  = m68k_unused_16_w;
926       zbank_memory_map[i].write   = zbank_unused_w;
927     }
928   }
929 }
930 
931 /*
932    Everdrive extended SSF ROM bankswitch
933    documented by Krikzz (http://krikzz.com/pub/support/mega-ed/dev/extended_ssf.txt)
934 */
mapper_512k_w(uint32 address,uint32 data)935 static void mapper_512k_w(uint32 address, uint32 data)
936 {
937   uint32 i;
938 
939   /* 512K ROM paging */
940   uint8 *src = cart.rom + (data << 19);
941 
942   /* cartridge area ($000000-$3FFFFF) is divided into 8 x 512K banks */
943   address = (address << 2) & 0x38;
944 
945   /* remap selected ROM page to selected bank */
946   for (i=0; i<8; i++)
947   {
948     m68k.memory_map[address++].base = src + (i<<16);
949   }
950 }
951 
952 /*
953    Super Street Fighter 2 ROM bankswitch
954    documented by Bart Trzynadlowski (http://emu-docs.org/Genesis/ssf2.txt)
955 */
mapper_ssf2_w(uint32 address,uint32 data)956 static void mapper_ssf2_w(uint32 address, uint32 data)
957 {
958   /* only banks 1-7 are remappable, bank 0 remains unchanged */
959   if (address & 0x0E)
960   {
961     mapper_512k_w(address, data);
962   }
963 }
964 
965 /*
966   SF-001 mapper
967 */
mapper_sf001_w(uint32 address,uint32 data)968 static void mapper_sf001_w(uint32 address, uint32 data)
969 {
970   switch ((address >> 8) & 0xf)
971   {
972     case 0xe:
973     {
974       int i;
975 
976       /* bit 6: enable / disable cartridge access  */
977       if (data & 0x40)
978       {
979         /* $000000-$3FFFFF is not mapped */
980         for (i=0x00; i<0x40; i++)
981         {
982           m68k.memory_map[i].base     = cart.rom + (i << 16);
983           m68k.memory_map[i].read8    = m68k_read_bus_8;
984           m68k.memory_map[i].read16   = m68k_read_bus_16;
985           m68k.memory_map[i].write8   = (i > 0x00) ? m68k_unused_8_w : mapper_sf001_w;
986           m68k.memory_map[i].write16  = (i > 0x00) ? m68k_unused_16_w : mapper_sf001_w;
987           zbank_memory_map[i].read    = zbank_unused_r;
988           zbank_memory_map[i].write   = (i > 0x00) ? m68k_unused_8_w : mapper_sf001_w;
989         }
990       }
991 
992       /* bit 7: enable / disable SRAM & ROM bankswitching */
993       else if (data & 0x80)
994       {
995         /* 256K ROM bank #15 mapped to $000000-$03FFFF  */
996         for (i=0x00; i<0x04; i++)
997         {
998           m68k.memory_map[i].base     = cart.rom + ((0x38 + i) << 16);
999           m68k.memory_map[i].read8    = NULL;
1000           m68k.memory_map[i].read16   = NULL;
1001           zbank_memory_map[i].read    = NULL;
1002         }
1003 
1004         /* 256K ROM banks #2 to #15 mapped to $040000-$3BFFFF (last revision) or $040000-$3FFFFF (older revisions) */
1005         for (i=0x04; i<(sram.start >> 16); i++)
1006         {
1007           m68k.memory_map[i].base     = cart.rom + (i << 16);
1008           m68k.memory_map[i].read8    = NULL;
1009           m68k.memory_map[i].read16   = NULL;
1010           zbank_memory_map[i].read    = NULL;
1011         }
1012 
1013         /* 32K static RAM mirrored into $3C0000-$3FFFFF (odd bytes only) (last revision only) */
1014         while (i<0x40)
1015         {
1016           m68k.memory_map[i].base     = sram.sram;
1017           m68k.memory_map[i].read8    = sram_read_byte;
1018           m68k.memory_map[i].read16   = sram_read_word;
1019           m68k.memory_map[i].write8   = sram_write_byte;
1020           m68k.memory_map[i].write16  = sram_write_word;
1021           zbank_memory_map[i].read    = sram_read_byte;
1022           zbank_memory_map[i].write   = sram_write_byte;
1023           i++;
1024         }
1025       }
1026       else
1027       {
1028         /* 256K ROM banks #1 to #16 mapped to $000000-$3FFFFF (default) */
1029         for (i=0x00; i<0x40; i++)
1030         {
1031           m68k.memory_map[i].base     = cart.rom + (i << 16);
1032           m68k.memory_map[i].read8    = NULL;
1033           m68k.memory_map[i].read16   = NULL;
1034           m68k.memory_map[i].write8   = (i > 0x00) ? m68k_unused_8_w : mapper_sf001_w;
1035           m68k.memory_map[i].write16  = (i > 0x00) ? m68k_unused_16_w : mapper_sf001_w;
1036           zbank_memory_map[i].read    = NULL;
1037           zbank_memory_map[i].write   = (i > 0x00) ? m68k_unused_8_w : mapper_sf001_w;
1038         }
1039       }
1040 
1041       /* bit 5: lock bankswitch hardware when set */
1042       if (data & 0x20)
1043       {
1044         /* disable bankswitch hardware access until hard reset */
1045         m68k.memory_map[0x00].write8  = m68k_unused_8_w;
1046         m68k.memory_map[0x00].write16 = m68k_unused_16_w;
1047         zbank_memory_map[0x00].write  = m68k_unused_8_w;
1048       }
1049 
1050       return;
1051     }
1052 
1053     default:
1054     {
1055       m68k_unused_8_w(address, data);
1056       return;
1057     }
1058   }
1059 }
1060 
1061 /*
1062   SF-002 mapper
1063 */
mapper_sf002_w(uint32 address,uint32 data)1064 static void mapper_sf002_w(uint32 address, uint32 data)
1065 {
1066   int i;
1067   if (data & 0x80)
1068   {
1069     /* $000000-$1BFFFF mapped to $200000-$3BFFFF */
1070     for (i=0x20; i<0x3C; i++)
1071     {
1072       m68k.memory_map[i].base = cart.rom + ((i & 0x1F) << 16);
1073     }
1074   }
1075   else
1076   {
1077     /* $200000-$3BFFFF mapped to $200000-$3BFFFF */
1078     for (i=0x20; i<0x3C; i++)
1079     {
1080       m68k.memory_map[i].base = cart.rom + (i << 16);
1081     }
1082   }
1083 }
1084 
1085 /*
1086   SF-004 mapper
1087 */
mapper_sf004_w(uint32 address,uint32 data)1088 static void mapper_sf004_w(uint32 address, uint32 data)
1089 {
1090   int i;
1091   switch ((address >> 8) & 0xf)
1092   {
1093     case 0xd:
1094     {
1095       /* bit 7: enable/disable static RAM access */
1096       if (data & 0x80)
1097       {
1098         /* 32KB static RAM mirrored into $200000-$2FFFFF (odd bytes only) */
1099         for (i=0x20; i<0x30; i++)
1100         {
1101           m68k.memory_map[i].read8   = sram_read_byte;
1102           m68k.memory_map[i].read16  = sram_read_word;
1103           m68k.memory_map[i].write8  = sram_write_byte;
1104           m68k.memory_map[i].write16 = sram_write_word;
1105           zbank_memory_map[i].read   = sram_read_byte;
1106           zbank_memory_map[i].write  = sram_write_byte;
1107         }
1108       }
1109       else
1110       {
1111         /* 32KB static RAM disabled at $200000-$2FFFFF */
1112         for (i=0x20; i<0x30; i++)
1113         {
1114           m68k.memory_map[i].read8   = m68k_read_bus_8;
1115           m68k.memory_map[i].read16  = m68k_read_bus_16;
1116           m68k.memory_map[i].write8  = m68k_unused_8_w;
1117           m68k.memory_map[i].write16 = m68k_unused_16_w;
1118           zbank_memory_map[i].read   = m68k_read_bus_8;
1119           zbank_memory_map[i].write  = m68k_unused_8_w;
1120         }
1121       }
1122 
1123       return;
1124     }
1125 
1126     case 0x0e:
1127     {
1128       /* bit 5: enable / disable cartridge ROM access */
1129       if (data & 0x20)
1130       {
1131         /* $000000-$1FFFFF is not mapped */
1132         for (i=0x00; i<0x20; i++)
1133         {
1134           m68k.memory_map[i].read8  = m68k_read_bus_8;
1135           m68k.memory_map[i].read16 = m68k_read_bus_16;
1136           zbank_memory_map[i].read  = m68k_read_bus_8;
1137         }
1138       }
1139 
1140       /* bit 6: enable / disable first page mirroring */
1141       else if (data & 0x40)
1142       {
1143         /* first page ROM bank */
1144         uint8 base = (m68k.memory_map[0x00].base - cart.rom) >> 16;
1145 
1146         /* 5 x 256K ROM banks mapped to $000000-$13FFFF, starting from first page ROM bank */
1147         for (i=0x00; i<0x14; i++)
1148         {
1149           m68k.memory_map[i].base   = cart.rom + (((base + i) & 0x1f) << 16);
1150           m68k.memory_map[i].read8  = NULL;
1151           m68k.memory_map[i].read16 = NULL;
1152           zbank_memory_map[i].read  = NULL;
1153         }
1154 
1155         /* $140000-$1FFFFF is not mapped */
1156         for (i=0x14; i<0x20; i++)
1157         {
1158           m68k.memory_map[i].read8  = m68k_read_bus_8;
1159           m68k.memory_map[i].read16 = m68k_read_bus_16;
1160           zbank_memory_map[i].read  = m68k_read_bus_8;
1161         }
1162       }
1163       else
1164       {
1165         /* first page 256K ROM bank mirrored into $000000-$1FFFFF */
1166         for (i=0x00; i<0x20; i++)
1167         {
1168           m68k.memory_map[i].base = m68k.memory_map[0].base + ((i & 0x03) << 16);
1169           m68k.memory_map[i].read8  = NULL;
1170           m68k.memory_map[i].read16 = NULL;
1171           zbank_memory_map[i].read  = NULL;
1172         }
1173       }
1174 
1175       /* bit 7: lock ROM bankswitching hardware when cleared */
1176       if (!(data & 0x80))
1177       {
1178         /* disable bankswitch hardware access */
1179         m68k.memory_map[0x00].write8 = m68k_unused_8_w;
1180         m68k.memory_map[0x00].write16 = m68k_unused_16_w;
1181         zbank_memory_map[0x00].write = m68k_unused_8_w;
1182       }
1183 
1184       return;
1185     }
1186 
1187     case 0x0f:
1188     {
1189       /* bits 6-4: select first page ROM bank (8 x 256K ROM banks) */
1190       uint8 base = ((data >> 4) & 7) << 2;
1191 
1192       if (m68k.memory_map[0].base == m68k.memory_map[4].base)
1193       {
1194         /* selected 256K ROM bank mirrored into $000000-$1FFFFF */
1195         for (i=0x00; i<0x20; i++)
1196         {
1197           m68k.memory_map[i].base = cart.rom + ((base + (i & 0x03)) << 16);
1198         }
1199       }
1200       else
1201       {
1202         /* 5 x 256K ROM banks mapped to $000000-$13FFFF, starting from selected bank */
1203         for (i=0x00; i<0x14; i++)
1204         {
1205           m68k.memory_map[i].base = cart.rom + (((base + i) & 0x1f) << 16);
1206         }
1207       }
1208 
1209       return;
1210     }
1211 
1212     default:
1213     {
1214       m68k_unused_8_w(address, data);
1215       return;
1216     }
1217   }
1218 }
1219 
mapper_sf004_r(uint32 address)1220 static uint32 mapper_sf004_r(uint32 address)
1221 {
1222   /* return first page 256K bank index ($00,$10,$20,...,$70) */
1223   return (((m68k.memory_map[0x00].base - cart.rom) >> 18) << 4);
1224 }
1225 
1226 /*
1227   T-5740xx-xx mapper
1228 */
mapper_t5740_w(uint32 address,uint32 data)1229 static void mapper_t5740_w(uint32 address, uint32 data)
1230 {
1231   int i;
1232   uint8 *base;
1233 
1234   switch (address & 0xff)
1235   {
1236     case 0x01: /* mode register */
1237     {
1238       /* bits 7-4: unused ?                           */
1239       /* bit 3: enable SPI registers access ?         */
1240       /* bit 2: not used ?                            */
1241       /* bit 1: enable bankswitch registers access ?  */
1242       /* bit 0: always set, enable hardware access ?  */
1243       return;
1244     }
1245 
1246     case 0x03: /* page #5 register */
1247     {
1248       /* map any of 16 x 512K ROM banks to $280000-$2FFFFF */
1249       base = cart.rom + ((data & 0x0f) << 19);
1250       for (i=0x28; i<0x30; i++)
1251       {
1252         m68k.memory_map[i].base = base + ((i & 0x07) << 16);
1253       }
1254       return;
1255     }
1256 
1257     case 0x05: /* page #6 register */
1258     {
1259       /* map any of 16 x 512K ROM banks to $300000-$37FFFF */
1260       base = cart.rom + ((data & 0x0f) << 19);
1261       for (i=0x30; i<0x38; i++)
1262       {
1263         m68k.memory_map[i].base = base + ((i & 0x07) << 16);
1264       }
1265       return;
1266     }
1267 
1268     case 0x07: /* page #7 register */
1269     {
1270       /* map any of 16 x 512K ROM banks to $380000-$3FFFFF */
1271       base = cart.rom + ((data & 0x0f) << 19);
1272       for (i=0x38; i<0x40; i++)
1273       {
1274         m68k.memory_map[i].base = base + ((i & 0x07) << 16);
1275       }
1276       return;
1277     }
1278 
1279     case 0x09: /* serial EEPROM SPI board support */
1280     {
1281       eeprom_spi_write(data);
1282       return;
1283     }
1284 
1285     default:
1286     {
1287       /* unknown registers */
1288       m68k_unused_8_w(address, data);
1289       return;
1290     }
1291   }
1292 }
1293 
mapper_t5740_r(uint32 address)1294 static uint32 mapper_t5740_r(uint32 address)
1295 {
1296   /* By default, first 32K of each eight 512K pages mapped in $000000-$3FFFFF are mirrored in the 512K page   */
1297   /* mirroring is disabled/enabled when a specific number of words is being read from specific ROM addresses  */
1298   /* Exact decoding isn't known but mirrored data is expected on startup when reading a few times from $181xx */
1299   /* this area doesn't seem to be accessed as byte later so it seems safe to always return mirrored data here */
1300   if ((address & 0xff00) == 0x8100)
1301   {
1302     return READ_BYTE(cart.rom , (address & 0x7fff));
1303   }
1304 
1305   return READ_BYTE(cart.rom, address);
1306 }
1307 
1308 /*
1309   FlashKit MD mapper (very limited M29W320xx Flash memory support -- enough for unlicensed games using device signature as protection)
1310 */
mapper_flashkit_w(uint32 address,uint32 data)1311 static void mapper_flashkit_w(uint32 address, uint32 data)
1312 {
1313   /* Increment Bus Write counter */
1314   cart.hw.regs[0]++;
1315 
1316   /* Wait for 3 consecutive bus writes */
1317   if (cart.hw.regs[0] == 3)
1318   {
1319     /* assume 'Auto Select' command */
1320     m68k.memory_map[0x0].read16 = mapper_flashkit_r;
1321   }
1322   else if (cart.hw.regs[0] == 4)
1323   {
1324     /* assume 'Read/Reset' command */
1325     m68k.memory_map[0x0].read16 = NULL;
1326 
1327     /* reset Bus Write counter */
1328     cart.hw.regs[0] = 0;
1329   }
1330 }
1331 
mapper_flashkit_r(uint32 address)1332 static uint32 mapper_flashkit_r(uint32 address)
1333 {
1334   /* hard-coded device signature */
1335   switch (address & 0x06)
1336   {
1337     case 0x00:  /* Manufacturer Code (STMicroelectronics) */
1338       return 0x0020;
1339     case 0x02:  /* Device Code (M29W320EB) */
1340       return 0x2257;
1341     default:    /* not supported */
1342       return 0xffff;
1343   }
1344 }
1345 
1346 /*
1347   Super Mario World 64 (unlicensed) mapper
1348 */
mapper_smw_64_w(uint32 address,uint32 data)1349 static void mapper_smw_64_w(uint32 address, uint32 data)
1350 {
1351   /* internal registers (saved to backup RAM) */
1352   switch ((address >> 16) & 0x07)
1353   {
1354     case 0x00:  /* $60xxxx */
1355     {
1356       if (address & 2)
1357       {
1358         /* $600003 data write mode ? */
1359         switch (sram.sram[0x00] & 0x07)
1360         {
1361           case 0x00:
1362           {
1363             /* update value returned at $660001-$660003 */
1364             sram.sram[0x06] = ((sram.sram[0x06] ^ sram.sram[0x01]) ^ data) & 0xFE;
1365             break;
1366           }
1367 
1368           case 0x01:
1369           {
1370             /* update value returned at $660005-$660007 */
1371             sram.sram[0x07] = data & 0xFE;
1372             break;
1373           }
1374 
1375           case 0x07:
1376           {
1377             /* update selected ROM bank (upper 512K) mapped at $610000-$61ffff */
1378             m68k.memory_map[0x61].base = m68k.memory_map[0x69].base = cart.rom + 0x080000 + ((data & 0x1c) << 14);
1379             break;
1380           }
1381 
1382           default:
1383           {
1384             /* unknown mode */
1385             break;
1386           }
1387         }
1388 
1389         /* $600003 data register */
1390         sram.sram[0x01] = data;
1391       }
1392       else
1393       {
1394         /* $600001 ctrl register */
1395         sram.sram[0x00] = data;
1396       }
1397       return;
1398     }
1399 
1400     case 0x01:  /* $61xxxx */
1401     {
1402       if (address & 2)
1403       {
1404         /* $610003 ctrl register */
1405         sram.sram[0x02] = data;
1406       }
1407       return;
1408     }
1409 
1410     case 0x04:  /* $64xxxx */
1411     {
1412       if (address & 2)
1413       {
1414         /* $640003 data register */
1415         sram.sram[0x04] = data;
1416       }
1417       else
1418       {
1419         /* $640001 data register */
1420         sram.sram[0x03] = data;
1421       }
1422       return;
1423     }
1424 
1425     case 0x06:  /* $66xxxx */
1426     {
1427       /* unknown */
1428       return;
1429     }
1430 
1431     case 0x07:  /* $67xxxx */
1432     {
1433       if (!(address & 2))
1434       {
1435         /* $670001 ctrl register */
1436         sram.sram[0x05] = data;
1437 
1438         /* upper 512K ROM bank-switching enabled ? */
1439         if (sram.sram[0x02] & 0x80)
1440         {
1441           /* update selected ROM bank (upper 512K) mapped at $600000-$60ffff */
1442           m68k.memory_map[0x60].base = m68k.memory_map[0x68].base = cart.rom + 0x080000 + ((data & 0x1c) << 14);
1443         }
1444       }
1445       return;
1446     }
1447 
1448     default:  /* not used */
1449     {
1450       m68k_unused_8_w(address, data);
1451       return;
1452     }
1453   }
1454 }
1455 
mapper_smw_64_r(uint32 address)1456 static uint32 mapper_smw_64_r(uint32 address)
1457 {
1458   /* internal registers (saved to backup RAM) */
1459   switch ((address >> 16) & 0x03)
1460   {
1461     case 0x02:  /* $66xxxx */
1462     {
1463       switch ((address >> 1) & 7)
1464       {
1465         case 0x00:  return sram.sram[0x06];
1466         case 0x01:  return sram.sram[0x06] + 1;
1467         case 0x02:  return sram.sram[0x07];
1468         case 0x03:  return sram.sram[0x07] + 1;
1469         case 0x04:  return sram.sram[0x08];
1470         case 0x05:  return sram.sram[0x08] + 1;
1471         case 0x06:  return sram.sram[0x08] + 2;
1472         case 0x07:  return sram.sram[0x08] + 3;
1473       }
1474     }
1475 
1476     case 0x03:  /* $67xxxx */
1477     {
1478       uint8 data = (sram.sram[0x02] & 0x80) ? ((sram.sram[0x05] & 0x40) ? (sram.sram[0x03] & sram.sram[0x04]) : (sram.sram[0x03] ^ 0xFF)) : 0x00;
1479 
1480       if (address & 2)
1481       {
1482         /* $670003 */
1483         data &= 0x7f;
1484       }
1485       else
1486       {
1487         /* $66xxxx data registers update */
1488         if (sram.sram[0x05] & 0x80)
1489         {
1490           if (sram.sram[0x05] & 0x20)
1491           {
1492             /* update $660009-$66000f data register */
1493             sram.sram[0x08] = (sram.sram[0x04] << 2) & 0xFC;
1494           }
1495           else
1496           {
1497             /* update $660001-$660003 data register */
1498             sram.sram[0x06] = (sram.sram[0x01] ^ (sram.sram[0x03] << 1)) & 0xFE;
1499           }
1500         }
1501       }
1502 
1503       return data;
1504     }
1505 
1506     default:  /* 64xxxx-$65xxxx */
1507     {
1508       return 0x00;
1509     }
1510   }
1511 }
1512 
1513 /*
1514   Realtec ROM bankswitch (Earth Defend, Balloon Boy & Funny World, Whac-A-Critter)
1515   (Note: register usage is inverted in TascoDlx documentation)
1516 */
mapper_realtec_w(uint32 address,uint32 data)1517 static void mapper_realtec_w(uint32 address, uint32 data)
1518 {
1519   switch (address)
1520   {
1521     case 0x402000:
1522     {
1523       /* number of mapped 64k blocks (the written value is a number of 128k blocks) */
1524       cart.hw.regs[2] = data << 1;
1525       return;
1526     }
1527 
1528     case 0x404000:
1529     {
1530       /* 00000xxx */
1531       cart.hw.regs[0] = data & 7;
1532       return;
1533     }
1534 
1535     case 0x400000:
1536     {
1537       /* 00000yy1 */
1538       cart.hw.regs[1] = data & 6;
1539 
1540       /* ensure mapped size is not null */
1541       if (cart.hw.regs[2])
1542       {
1543         /* mapped start address is 00yy xxx0 0000 0000 0000 0000 */
1544         uint32 base = (cart.hw.regs[0] << 1) | (cart.hw.regs[1] << 3);
1545 
1546         /* selected blocks are mirrored into the whole cartridge area */
1547         int i;
1548         for (i=0x00; i<0x40; i++)
1549         {
1550           m68k.memory_map[i].base = &cart.rom[(base + (i % cart.hw.regs[2])) << 16];
1551         }
1552       }
1553       return;
1554     }
1555   }
1556 }
1557 
1558 /* Game no Kanzume Otokuyou ROM Mapper */
mapper_seganet_w(uint32 address,uint32 data)1559 static void mapper_seganet_w(uint32 address, uint32 data)
1560 {
1561   if ((address & 0xff) == 0xf1)
1562   {
1563     int i;
1564     if (data & 1)
1565     {
1566       /* ROM Write protected */
1567       for (i=0; i<0x40; i++)
1568       {
1569         m68k.memory_map[i].write8   = m68k_unused_8_w;
1570         m68k.memory_map[i].write16  = m68k_unused_16_w;
1571         zbank_memory_map[i].write   = zbank_unused_w;
1572       }
1573     }
1574     else
1575     {
1576       /* ROM Write enabled */
1577       for (i=0; i<0x40; i++)
1578       {
1579         m68k.memory_map[i].write8   = NULL;
1580         m68k.memory_map[i].write16  = NULL;
1581         zbank_memory_map[i].write   = NULL;
1582       }
1583     }
1584   }
1585 }
1586 
1587 /*
1588   Custom ROM Bankswitch used in Soul Edge VS Samurai Spirits, Top Fighter, Mulan, Pocket Monsters II, Lion King 3, Super King Kong 99, Pokemon Stadium
1589 */
mapper_32k_w(uint32 data)1590 static void mapper_32k_w(uint32 data)
1591 {
1592   int i;
1593 
1594   /* 64 x 32k banks */
1595   if (data)
1596   {
1597     for (i=0; i<0x10; i++)
1598     {
1599       /* Remap to unused ROM area  */
1600       m68k.memory_map[i].base = &cart.rom[0x400000 + (i << 16)];
1601 
1602       /* address = address OR (value << 15) */
1603       memcpy(m68k.memory_map[i].base, cart.rom + ((i << 16) | (data & 0x3f) << 15), 0x8000);
1604       memcpy(m68k.memory_map[i].base + 0x8000, cart.rom + ((i << 16) | ((data | 1) & 0x3f) << 15), 0x8000);
1605     }
1606   }
1607   else
1608   {
1609     /* reset default $000000-$0FFFFF mapping */
1610     for (i=0; i<16; i++)
1611     {
1612       m68k.memory_map[i].base = &cart.rom[i << 16];
1613     }
1614   }
1615 }
1616 
1617 /*
1618   Custom ROM Bankswitch used in Chinese Fighter III
1619 */
mapper_64k_w(uint32 data)1620 static void mapper_64k_w(uint32 data)
1621 {
1622   int i;
1623 
1624   /* 16 x 64k banks */
1625   if (data)
1626   {
1627     /* bank is mapped at $000000-$0FFFFF */
1628     for (i=0; i<16; i++)
1629     {
1630       m68k.memory_map[i].base = &cart.rom[(data & 0xf) << 16];
1631     }
1632   }
1633   else
1634   {
1635     /* reset default $000000-$0FFFFF mapping */
1636     for (i=0; i<16; i++)
1637     {
1638       m68k.memory_map[i].base = &cart.rom[(i & 0xf) << 16];
1639     }
1640   }
1641 }
1642 
1643 /*
1644   Custom ROM Bankswitch used in pirate "Multi-in-1" cartridges, A Bug's Life, King of Fighter 99, Pocket Monster, Rockman X3
1645  */
mapper_64k_multi_w(uint32 address)1646 static void mapper_64k_multi_w(uint32 address)
1647 {
1648   int i;
1649 
1650   /* 64 x 64k banks */
1651   for (i=0; i<64; i++)
1652   {
1653     m68k.memory_map[i].base = &cart.rom[((address++) & 0x3f) << 16];
1654   }
1655 }
1656 
1657 /*
1658   Custom ROM Bankswitch used in RADICA cartridges
1659 */
mapper_radica_r(uint32 address)1660 static uint32 mapper_radica_r(uint32 address)
1661 {
1662   int i = 0;
1663   address = (address >> 1);
1664 
1665   /* 64 x 64k banks */
1666   for (i = 0; i < 64; i++)
1667   {
1668     m68k.memory_map[i].base = &cart.rom[((address++)& 0x3f)<< 16];
1669   }
1670 
1671   return 0xffff;
1672 }
1673 
1674 
1675 /************************************************************
1676           default !TIME signal handler
1677 *************************************************************/
1678 
default_time_w(uint32 address,uint32 data)1679 static void default_time_w(uint32 address, uint32 data)
1680 {
1681   /* enable multi-game cartridge mapper by default */
1682   if (address < 0xa13040)
1683   {
1684     mapper_64k_multi_w(address);
1685     return;
1686   }
1687 
1688   /* enable "official" cartridge mapper by default */
1689   if (address > 0xa130f1)
1690   {
1691     mapper_512k_w(address, data);
1692   }
1693   else
1694   {
1695     mapper_sega_w(data);
1696   }
1697 }
1698 
1699 
1700 /************************************************************
1701           Internal register handlers
1702 *************************************************************/
1703 
default_regs_r(uint32 address)1704 static uint32 default_regs_r(uint32 address)
1705 {
1706   int i;
1707   for (i=0; i<4; i++)
1708   {
1709     if ((address & cart.hw.mask[i]) == cart.hw.addr[i])
1710     {
1711       return cart.hw.regs[i];
1712     }
1713   }
1714   return m68k_read_bus_8(address);
1715 }
1716 
default_regs_r_16(uint32 address)1717 static uint32 default_regs_r_16(uint32 address)
1718 {
1719   int i;
1720   for (i=0; i<4; i++)
1721   {
1722     if ((address & cart.hw.mask[i]) == cart.hw.addr[i])
1723     {
1724       return (cart.hw.regs[i] << 8);
1725     }
1726   }
1727   return m68k_read_bus_16(address);
1728 }
1729 
default_regs_w(uint32 address,uint32 data)1730 static void default_regs_w(uint32 address, uint32 data)
1731 {
1732   int i;
1733   for (i=0; i<4; i++)
1734   {
1735     if ((address & cart.hw.mask[i]) == cart.hw.addr[i])
1736     {
1737       cart.hw.regs[i] = data;
1738       return;
1739     }
1740   }
1741   m68k_unused_8_w(address, data);
1742 }
1743 
1744 /* basic register shifting hardware (Bug's Life, Pocket Monster) */
custom_regs_r(uint32 address)1745 static uint32 custom_regs_r(uint32 address)
1746 {
1747   int i;
1748   for (i=0; i<4; i++)
1749   {
1750     if ((address & cart.hw.mask[i]) == cart.hw.addr[i])
1751     {
1752       return cart.hw.regs[i] >> 1;
1753     }
1754   }
1755 
1756   return m68k_read_bus_8(address);
1757 }
1758 
1759 /* custom register hardware (Top Fighter, Lion King III, Super Donkey Kong  99, Mulan, Pocket Monsters II, Pokemon Stadium) */
custom_regs_w(uint32 address,uint32 data)1760 static void custom_regs_w(uint32 address, uint32 data)
1761 {
1762   uint8 temp;
1763 
1764   /* ROM bankswitch */
1765   if ((address >> 16) > 0x6f)
1766   {
1767     mapper_32k_w(data);
1768     return;
1769   }
1770 
1771   /* write register */
1772   default_regs_w(address, data);
1773 
1774   /* bitswapping */
1775   temp = cart.hw.regs[0];
1776   switch (cart.hw.regs[1] & 3)
1777   {
1778     case 0:
1779       cart.hw.regs[2] = (temp << 1);
1780       break;
1781 
1782     case 1:
1783       cart.hw.regs[2] = (temp >> 1);
1784       return;
1785 
1786     case 2:
1787       cart.hw.regs[2] = ((temp >> 4) | ((temp & 0x0F) << 4));
1788       return;
1789 
1790     default:
1791       cart.hw.regs[2] = (((temp >> 7) & 0x01) | ((temp >> 5) & 0x02) |
1792                          ((temp >> 3) & 0x04) | ((temp >> 1) & 0x08) |
1793                          ((temp << 1) & 0x10) | ((temp << 3) & 0x20) |
1794                          ((temp << 5) & 0x40) | ((temp << 7) & 0x80));
1795       return;
1796   }
1797 }
1798 
1799 /* alternate custom register hardware (Chinese Fighters III) */
custom_alt_regs_w(uint32 address,uint32 data)1800 static void custom_alt_regs_w(uint32 address, uint32 data)
1801 {
1802   /* ROM bankswitch */
1803   if ((address >> 16) > 0x5f)
1804   {
1805     mapper_64k_w(data);
1806     return;
1807   }
1808 
1809   /* write regs */
1810   default_regs_w(address, data);
1811 }
1812 
1813 
1814 /* "Tekken 3 Special" custom register hardware */
tekken_regs_r(uint32 address)1815 static uint32 tekken_regs_r(uint32 address)
1816 {
1817   /* data output */
1818   if ((address & 0x0e) == 0x02)
1819   {
1820     /* maybe depends on mode bits ? */
1821     return (cart.hw.regs[0] - 1);
1822   }
1823 
1824   return m68k_read_bus_16(address);
1825 }
1826 
tekken_regs_w(uint32 address,uint32 data)1827 static void tekken_regs_w(uint32 address, uint32 data)
1828 {
1829   switch (address & 0x0e)
1830   {
1831     case 0x00:
1832     {
1833       /* data output reset ? (game writes $FF before & after protection check) */
1834       cart.hw.regs[0]= 0x00;
1835       break;
1836     }
1837 
1838     case 0x02:
1839     {
1840       /* read only ? */
1841       break;
1842     }
1843 
1844     case 0x0c:
1845     {
1846       /* data output mode bit 0 ? (game writes $01) */
1847       break;
1848     }
1849 
1850     case 0x0e:
1851     {
1852       /* data output mode bit 1 ? (never written by game) */
1853       break;
1854     }
1855 
1856     default:
1857     {
1858       /* data input (only connected to D0 ?)*/
1859       if (data & 1)
1860       {
1861         /* 4-bit hardware register ($400004 corresponds to bit0, $400006 to bit1, etc) */
1862         cart.hw.regs[0] |= 1 << (((address - 0x04) >> 1) & 3);
1863       }
1864       break;
1865     }
1866   }
1867 }
1868 
1869 /* "Top Shooter" arcade board hardware */
topshooter_r(uint32 address)1870 static uint32 topshooter_r(uint32 address)
1871 {
1872   if (address < 0x202000)
1873   {
1874     uint8 temp = 0xff;
1875 
1876     switch (address & 0xff)
1877     {
1878       case 0x43:
1879       {
1880         if (input.pad[0] & INPUT_A)     temp &= ~0x80; /* Shoot */
1881         if (input.pad[0] & INPUT_B)     temp &= ~0x10; /* Bet */
1882         if (input.pad[0] & INPUT_START) temp &= ~0x20; /* Start */
1883         break;
1884       }
1885 
1886       case 0x45:  /* ??? (DOWN) & Service Mode (UP) */
1887       {
1888         if (input.pad[0] & INPUT_UP)    temp &= ~0x08; /* Service Mode */
1889         if (input.pad[0] & INPUT_DOWN)  temp &= ~0x10; /* ???, used in service menu to select next option */
1890         break;
1891       }
1892 
1893       case 0x47:
1894       {
1895         if (input.pad[0] & INPUT_RIGHT) temp &= ~0x03; /* Insert 10 coins */
1896         break;
1897       }
1898 
1899       case 0x49:
1900       {
1901         if (input.pad[0] & INPUT_LEFT)  temp &= ~0x03; /* Clear coins */
1902         if (input.pad[0] & INPUT_C)     temp &= ~0x01; /* Insert XXX coins */
1903         break;
1904       }
1905 
1906       case 0x51:
1907       {
1908         temp = 0xA5;
1909         break;
1910       }
1911 
1912       default:
1913       {
1914         temp = m68k_read_bus_8(address);
1915         break;
1916       }
1917     }
1918     return temp;
1919   }
1920 
1921   return READ_BYTE(sram.sram , address & 0xffff);
1922 }
1923 
topshooter_w(uint32 address,uint32 data)1924 static void topshooter_w(uint32 address, uint32 data)
1925 {
1926   if (address >= 0x202000)
1927   {
1928     WRITE_BYTE(sram.sram , address & 0xffff, data);
1929     return;
1930   }
1931 
1932   m68k_unused_8_w(address, data);
1933 }
1934 
1935 
1936 /* Sega Channel hardware (not emulated) */
1937 /*
1938 
1939 $A13004: BUSY ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?
1940 
1941 Unused read16 00A13004 (00005B54)
1942 Unused read16 00A13004 (00005B70)
1943 Unused read16 00A13006 (00005B7C)
1944 
1945 Unused read16 00A13004 (00005BC4)
1946 Unused read16 00A13004 (00005BDA)
1947 
1948 Unused write16 00A13032 = 0004 (00005706)
1949 Unused write16 00A130F0 = 0000 (0000570E)
1950 
1951 Unused write16 00A130F0 = 0000 (0000463E)
1952 Unused write16 00A130F2 = 0001 (00004646)
1953 Unused write16 00A130F4 = 0002 (0000464E)
1954 Unused write16 00A130F6 = 0003 (00004656)
1955 Unused write16 00A130F8 = 0004 (0000465E)
1956 Unused write16 00A130FA = 0005 (00004666)
1957 
1958 Unused write16 00A13032 = 0004 (00005706)
1959 Unused write16 00A13032 = 0104 (0000579E)
1960 
1961 Unused write16 00380000 = ACDC (00005718)
1962 Unused write16 00380002 = 0000 (00005722)
1963 Unused read16 00380000 (0000572C)
1964 Unused write16 00A13032 = 0104 (0000579E)
1965 Unused write16 00300000 = ACDC (000057B2)
1966 Unused write16 00380000 = 0000 (000057BC)
1967 Unused read16 00300000 (000057C6)
1968 
1969 static uint32 sega_channel_r(uint32 address)
1970 {
1971   return m68k_read_bus_16(address);;
1972 }
1973 
1974 static void sega_channel_w(uint32 address, uint32 data)
1975 {
1976   m68k_unused_16_w(address, data);
1977 }
1978 */
1979